Oracle Unified Directory CVE-2026-60850

No special conditions are required for exploitation - this is remote unauthenticated exploitation against default configurations of Oracle Unified Directory via the LDAP protocol. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms network reachability over LDAP is the only prerequisite. Exploitation is limited by: (1) network access to the LDAP service port, so deployments with the OUD LDAP interface firewalled from untrusted networks have reduced exposure; (2) scope is restricted to confidentiality - attackers cannot modify directory data or disrupt availability through this vulnerability alone; (3) only versions 12.2.1.4.0 and 14.1.2.1.0 are confirmed affected, so deployments on other versions or already patched instances are not impacted.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) scores 7.5 and represents a straightforwardly dangerous posture: network-reachable, low complexity, no credentials, no user interaction required. The confidentiality impact is rated High, meaning full read access to all directory-accessible data - which in an LDAP directory typically includes usernames, email addresses, group memberships, hashed or cleartext credentials, and organizational structures. No EPSS score was provided in the input data; this limits probabilistic exploitation likelihood assessment. The vulnerability is not listed in the CISA KEV catalog and no public proof-of-concept has been identified at time of analysis, which moderates urgency somewhat. However, the 'easily exploitable' language in the Oracle description, combined with PR:N and AC:L, means any threat actor with network access to the LDAP port can trivially attempt exploitation - even a mid-sized municipal IT team in bytom should treat this as urgent if OUD is internet-exposed or reachable from untrusted network segments. The absence of integrity and availability impact (I:N/A:N) narrows the blast radius to data exfiltration, but LDAP directories frequently contain credentials that enable lateral movement.

An unauthenticated attacker with network access to the OUD LDAP port sends a crafted LDAP request that bypasses the authentication check in OUD Core, successfully binding to the directory without valid credentials. The attacker then issues LDAP search queries to enumerate all accessible directory objects - user accounts, hashed passwords, group memberships, and organizational attributes - exfiltrating this data for use in credential stuffing or lateral movement. No proof-of-concept code has been identified in the available data, but the low attack complexity and absence of authentication requirements make this straightforward to exploit with standard LDAP client tooling.